Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Broadcom patches three critical VMware flaws, including vCenter auth bypass CVE-2026-59309 and an ESX VM escape, urging immediate updates.
Broadcom issued emergency updates for VMware ESX, vCenter, Workstation and Fusion, fixing five flaws including CVE-2026-59309 (CVSS 9.8 authentication bypass in vCenter) and CVE-2026-59310 (CVSS 9.8 directory traversal allowing code execution). CVE-2026-47876 (CVSS 9.3) is an out-of-bounds write in the ESX VMXNET3 adapter that permits a virtual machine escape to the host. Broadcom found no evidence of exploitation, but Defused Cyber reported a spike in vCenter scanning on August 11, 2026 consistent with exploitation attempts against CVE-2026-59309 (VMSA-2026-0006). No workarounds are available.
- CVE-2026-59309 and CVE-2026-59310 (both CVSS 9.8) allow vCenter authentication bypass and code execution via directory traversal.
- CVE-2026-47876 (CVSS 9.3) enables VM escape from guest to ESX host via VMXNET3 out-of-bounds write.
- No confirmed exploitation, but honeypots show increased scanning of vCenter SSO endpoints for CVE-2026-59309.
- No workarounds; Broadcom classified the updates as an emergency change requiring immediate action.
- Organizations
- Defused Cyber
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41703 | VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability | 7.6 | <1% | ||
| CVE-2026-41709 | Insufficient logging in VMware ESX for admin operations | 2.7 | <1% | KEV | KEV |
| CVE-2026-47876 | VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter | 9.3 | <1% | ||
| CVE-2026-59309 | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service | 9.8 | 8% | ||
| CVE-2026-59310 | Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog | 9.8 | 3% | KEVRansomwarePoC ×2 | KEV |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Jul 29, 2026 Vulnerability / Enterprise Security Broadcom has released security updates to address multiple security flaws impacting VMware ESX, vCenter, Workstation, and Fusion, three of which have been designated as critical in severity. The first of the three critical-rated flaws is CVE-2026-59309 (CVSS score: 9. 8), which has been described as an authentication bypass in VMware vCenter.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.